package policy
default allow = true
